Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361

CVEs used by ransomware · 21% of the KEV catalog

added in the last 90 days

173

critical

121

victims posted (30 days)

408

groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

202627
202531
202444
202343
2022132
202184

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

Group	Victims	Last activity
N0n	41	13h
Wallstreet	13	1d
qilin	9	1d
interlock	6	3d
play	5	2d
akira	3	1d
AuditTeam	3	2d
Dark Project	3	3d
lockbit5	3	1d
Emperador	3	8h
everest	3	2d
iah6477	3	6h

All groups →

Most affected countries (30 days)

United States25
Sweden10
Brazil8
South Korea8
United Kingdom5
Singapore4
India4
Spain3
Germany3
Japan3

Most affected sectors (30 days)

Transportation28
Professional Services19
Healthcare13
Manufacturing11
Other10
Retail & E-Commerce8
Technology7
Financial Services3
Energy & Utilities3
Hospitality2

CVEs used in ransomware campaigns

117 result(s)

CVE-2026-45659 High · 8.8 KEV Urgent · 70 Public exploit Ransomware CWE-502 May 22, 2026

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-33825 High · 7.8 KEV High · 62 Public exploit Ransomware CWE-1220 Apr 14, 2026

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

CVE-2023-21529 High · 8.8 KEV High · 66 Ransomware CWE-502 Feb 14, 2023

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2025-60710 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-59 Nov 11, 2025

Microsoft Windows Link Following Vulnerability

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

CVE-2021-43226 High · 7.8 KEV Urgent · 70 Public exploit Ransomware Dec 15, 2021

Microsoft Windows Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2025-49706 Medium · 6.5 KEV Urgent · 83 Public exploit Ransomware CWE-287 Jul 8, 2025

Microsoft SharePoint Improper Authentication Vulnerability

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-49704 High · 8.8 KEV Urgent · 78 Public exploit Ransomware CWE-94 Jul 8, 2025

Microsoft SharePoint Code Injection Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2025-53770 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-502 Jul 19, 2025

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

CVE-2025-29824 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-416 Apr 8, 2025

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-26633 High · 7.0 KEV Urgent · 80 Public exploit Ransomware CWE-707 Mar 11, 2025

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

CVE-2018-8639 High · 7.8 KEV High · 66 Ransomware CWE-404 Dec 11, 2018

Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.

CVE-2024-49039 High · 8.8 KEV Urgent · 71 Public exploit Ransomware CWE-287 Nov 12, 2024

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2024-38094 High · 7.2 KEV High · 66 Ransomware CWE-502 Jul 9, 2024

Microsoft SharePoint Deserialization Vulnerability

Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2024-30088 High · 7.0 KEV Urgent · 82 Public exploit Ransomware CWE-367 Jun 11, 2024

Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

CVE-2020-0618 High · 8.8 KEV Urgent · 86 Public exploit Ransomware CWE-502 Feb 11, 2020

Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

CVE-2024-26169 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-269 Mar 12, 2024

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2024-30051 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-787 May 14, 2024

Microsoft DWM Core Library Privilege Escalation Vulnerability

Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2023-24955 High · 7.2 KEV Urgent · 84 Public exploit Ransomware CWE-94 May 9, 2023

Microsoft SharePoint Server Code Injection Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2024-21338 High · 7.8 KEV Urgent · 80 Public exploit Ransomware CWE-822 Feb 13, 2024

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-21412 High · 8.1 KEV Urgent · 72 Public exploit Ransomware CWE-693 Feb 13, 2024

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

Internet Shortcut Files Security Feature Bypass Vulnerability

CVE-2023-29357 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-303 Jun 13, 2023

Microsoft SharePoint Server Privilege Escalation Vulnerability

Microsoft SharePoint Server Elevation of Privilege Vulnerability

CVE-2023-36884 High · 7.5 KEV Urgent · 72 Public exploit Ransomware CWE-362 Jul 11, 2023

Microsoft Windows Search Remote Code Execution Vulnerability

Windows Search Remote Code Execution Vulnerability

CVE-2023-28252 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-787 Apr 11, 2023

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2019-1388 High · 7.8 KEV High · 65 Ransomware CWE-269 Nov 12, 2019

Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.

CVE-2023-24880 Medium · 4.4 KEV High · 63 Ransomware CWE-863 Mar 14, 2023

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.